Mobile computing devices such as smartphones and tablet computers are becoming more widely used every day. Android is an open-source, Linux based operating system for such mobile devices that is gaining an increasingly prevalent market share. A large community of developers write applications (“apps”) that run on Android devices. Many of these apps are available either for purchase or for free through the online Android Market, which is run by Google. Android apps can also be downloaded from other online stores and additional third-party sites. With the open nature of the Android environment, anyone can create and distribute Android apps.
Because of its openness, the Android platform is vulnerable to an attack called trojanization. To implement this attack, a malicious party starts with a legitimate app, downloaded from an online store or other source. The attacker strips the app's digital signature, adds additional (malicious) code to the app, resigns the app with an anonymous digital certificate, and redistributes the now malicious app to unsuspecting users through one of the existing channels. This is known as trojanizing an app. In effect, the attacker is taking advantage of the openness of the Android development and distribution environment to hide malicious code in an existing, legitimate app. Users seeking to download and run the legitimate app are tricked into downloading the trojanized version. When the trojanized app runs on the user's Android device, the new code the attacker added can execute malicious functionality, such as stealing contact information, logging data input, sending fraudulent communications, etc.
It would be desirable to address this issue.